SB2026062973 - Insufficient Logging in Linux kernel __audit_log_capset() in the audit subsystem
Published: June 29, 2026
Security Bulletin ID
SB2026062973
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Insufficient Logging (CVE-ID: CVE-2026-53287)
CWE-ID: CWE-778 - Insufficient Logging
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to conceal capability changes in audit records.
The vulnerability exists due to incorrect data recording in __audit_log_capset() in the audit subsystem when logging CAPSET operations. A local user can modify inheritable capabilities to conceal capability changes in audit records.
This can mask preparation for a privilege-escalating exec in audit data used for compliance and forensic analysis.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/0a065c51a225854768b772a0b733a44d77162582
- https://git.kernel.org/stable/c/151ee470edc3d7ed29fe72df678f8357d2ad8ced
- https://git.kernel.org/stable/c/75bd76c9eb2de9afeca03dc5152ebca5fb8fc816
- https://git.kernel.org/stable/c/95de7bb4bf535a9288549d401ebde83cdcbf2792
- https://git.kernel.org/stable/c/d782e4d200cd9036ef353eeb29525bfbfd13a14e
- https://git.kernel.org/stable/c/e35f3550c5b4fab33103c18654c293cee9850b0a
- https://git.kernel.org/stable/c/e4a640475e43f406fdfd56d370b1f34b0cbbc18d
- https://git.kernel.org/stable/c/febb4bf373ac565d3fb8d1f429827bdd983be496